Alerts Suppression Rules - List

Service:

Defender for Cloud

API-versie:

2019-01-01-preview

Lijst met alle regels voor negeren voor het opgegeven abonnement

GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/alertsSuppressionRules?api-version=2019-01-01-preview

Met optionele parameters:

GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/alertsSuppressionRules?api-version=2019-01-01-preview&AlertType={AlertType}

URI-parameters

Name	In	Vereist	Type	Description
subscriptionId	path	True	string pattern: ^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$	Azure-abonnements-id
api-version	query	True	string	API-versie voor de bewerking
AlertType	query		string	Type waarschuwing voor het ophalen van regels voor

Antwoorden

Name	Type	Description
200 OK	AlertsSuppressionRulesList	OK
Other Status Codes	CloudError	Foutreactie waarin wordt beschreven waarom de bewerking is mislukt.

Beveiliging

azure_auth

Azure Active Directory OAuth2-stroom

Type: oauth2
Stroom: implicit
Autorisatie-URL: https://login.microsoftonline.com/common/oauth2/authorize

Bereiken

Name	Description
user_impersonation	Uw gebruikersaccount imiteren

Voorbeelden

Get suppression alert rule for subscription, filtered by AlertType

Get suppression rules for subscription

Get suppression alert rule for subscription, filtered by AlertType

Voorbeeldaanvraag

HTTP

GET https://management.azure.com/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules?api-version=2019-01-01-preview

Java

/**
 * Samples for AlertsSuppressionRules List.
 */
public final class Main {
    /*
     * x-ms-original-file:
     * specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/
     * AlertsSuppressionRules/GetAlertsSuppressionRulesWithAlertType_example.json
     */
    /**
     * Sample code: Get suppression alert rule for subscription, filtered by AlertType.
     * 
     * @param manager Entry point to SecurityManager.
     */
    public static void getSuppressionAlertRuleForSubscriptionFilteredByAlertType(
        com.azure.resourcemanager.security.SecurityManager manager) {
        manager.alertsSuppressionRules().list("IpAnomaly", com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Go

package armsecurity_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/security/armsecurity"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/9ac34f238dd6b9071f486b57e9f9f1a0c43ec6f6/specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/AlertsSuppressionRules/GetAlertsSuppressionRulesWithAlertType_example.json
func ExampleAlertsSuppressionRulesClient_NewListPager_getSuppressionAlertRuleForSubscriptionFilteredByAlertType() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurity.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	pager := clientFactory.NewAlertsSuppressionRulesClient().NewListPager(&armsecurity.AlertsSuppressionRulesClientListOptions{AlertType: nil})
	for pager.More() {
		page, err := pager.NextPage(ctx)
		if err != nil {
			log.Fatalf("failed to advance page: %v", err)
		}
		for _, v := range page.Value {
			// You could use page here. We use blank identifier for just demo purposes.
			_ = v
		}
		// If the HTTP response code is 200 as defined in example definition, your page structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
		// page.AlertsSuppressionRulesList = armsecurity.AlertsSuppressionRulesList{
		// 	Value: []*armsecurity.AlertsSuppressionRule{
		// 		{
		// 			Name: to.Ptr("dismissIpAnomalyAlerts"),
		// 			Type: to.Ptr("Microsoft.Security/alertsSuppressionRules"),
		// 			ID: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissIpAnomalyAlerts"),
		// 			Properties: &armsecurity.AlertsSuppressionRuleProperties{
		// 				AlertType: to.Ptr("IpAnomaly"),
		// 				Comment: to.Ptr("Test VM"),
		// 				ExpirationDateUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-12-01T19:50:47.083Z"); return t}()),
		// 				LastModifiedUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-07-31T19:50:47.083Z"); return t}()),
		// 				Reason: to.Ptr("FalsePositive"),
		// 				State: to.Ptr(armsecurity.RuleStateEnabled),
		// 				SuppressionAlertsScope: &armsecurity.SuppressionAlertsScope{
		// 					AllOf: []*armsecurity.ScopeElement{
		// 						{
		// 							AdditionalProperties: map[string]any{
		// 								"in": []any{
		// 									"104.215.95.187",
		// 									"52.164.206.56",
		// 								},
		// 							},
		// 							Field: to.Ptr("entities.ip.address"),
		// 						},
		// 						{
		// 							AdditionalProperties: map[string]any{
		// 								"contains": "POWERSHELL.EXE",
		// 							},
		// 							Field: to.Ptr("entities.process.commandline"),
		// 					}},
		// 				},
		// 			},
		// 	}},
		// }
	}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

JavaScript

const { SecurityCenter } = require("@azure/arm-security");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to List of all the dismiss rules for the given subscription
 *
 * @summary List of all the dismiss rules for the given subscription
 * x-ms-original-file: specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/AlertsSuppressionRules/GetAlertsSuppressionRulesWithAlertType_example.json
 */
async function getSuppressionAlertRuleForSubscriptionFilteredByAlertType() {
  const subscriptionId =
    process.env["SECURITY_SUBSCRIPTION_ID"] || "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
  const credential = new DefaultAzureCredential();
  const client = new SecurityCenter(credential, subscriptionId);
  const resArray = new Array();
  for await (let item of client.alertsSuppressionRules.list()) {
    resArray.push(item);
  }
  console.log(resArray);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.Resources;
using Azure.ResourceManager.SecurityCenter.Models;
using Azure.ResourceManager.SecurityCenter;

// Generated from example definition: specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/AlertsSuppressionRules/GetAlertsSuppressionRulesWithAlertType_example.json
// this example is just showing the usage of "AlertsSuppressionRules_List" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this SubscriptionResource created on azure
// for more information of creating SubscriptionResource, please refer to the document of SubscriptionResource
string subscriptionId = "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
ResourceIdentifier subscriptionResourceId = SubscriptionResource.CreateResourceIdentifier(subscriptionId);
SubscriptionResource subscriptionResource = client.GetSubscriptionResource(subscriptionResourceId);

// get the collection of this SecurityAlertsSuppressionRuleResource
SecurityAlertsSuppressionRuleCollection collection = subscriptionResource.GetSecurityAlertsSuppressionRules();

// invoke the operation and iterate over the result
await foreach (SecurityAlertsSuppressionRuleResource item in collection.GetAllAsync())
{
    // the variable item is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityAlertsSuppressionRuleData resourceData = item.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

Console.WriteLine("Succeeded");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Voorbeeldrespons

Statuscode:

200

{
  "value": [
    {
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissIpAnomalyAlerts",
      "name": "dismissIpAnomalyAlerts",
      "type": "Microsoft.Security/alertsSuppressionRules",
      "properties": {
        "alertType": "IpAnomaly",
        "lastModifiedUtc": "2019-07-31T19:50:47.083633Z",
        "expirationDateUtc": "2019-12-01T19:50:47.083633Z",
        "state": "Enabled",
        "reason": "FalsePositive",
        "comment": "Test VM",
        "suppressionAlertsScope": {
          "allOf": [
            {
              "field": "entities.ip.address",
              "in": [
                "104.215.95.187",
                "52.164.206.56"
              ]
            },
            {
              "field": "entities.process.commandline",
              "contains": "POWERSHELL.EXE"
            }
          ]
        }
      }
    }
  ]
}

Get suppression rules for subscription

Voorbeeldaanvraag

HTTP

GET https://management.azure.com/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules?api-version=2019-01-01-preview

Java

/**
 * Samples for AlertsSuppressionRules List.
 */
public final class Main {
    /*
     * x-ms-original-file:
     * specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/
     * AlertsSuppressionRules/GetAlertsSuppressionRules_example.json
     */
    /**
     * Sample code: Get suppression rules for subscription.
     * 
     * @param manager Entry point to SecurityManager.
     */
    public static void getSuppressionRulesForSubscription(com.azure.resourcemanager.security.SecurityManager manager) {
        manager.alertsSuppressionRules().list(null, com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Go

package armsecurity_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/security/armsecurity"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/9ac34f238dd6b9071f486b57e9f9f1a0c43ec6f6/specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/AlertsSuppressionRules/GetAlertsSuppressionRules_example.json
func ExampleAlertsSuppressionRulesClient_NewListPager_getSuppressionRulesForSubscription() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurity.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	pager := clientFactory.NewAlertsSuppressionRulesClient().NewListPager(&armsecurity.AlertsSuppressionRulesClientListOptions{AlertType: nil})
	for pager.More() {
		page, err := pager.NextPage(ctx)
		if err != nil {
			log.Fatalf("failed to advance page: %v", err)
		}
		for _, v := range page.Value {
			// You could use page here. We use blank identifier for just demo purposes.
			_ = v
		}
		// If the HTTP response code is 200 as defined in example definition, your page structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
		// page.AlertsSuppressionRulesList = armsecurity.AlertsSuppressionRulesList{
		// 	Value: []*armsecurity.AlertsSuppressionRule{
		// 		{
		// 			Name: to.Ptr("dismissIpAnomalyAlerts"),
		// 			Type: to.Ptr("Microsoft.Security/alertsSuppressionRules"),
		// 			ID: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissIpAnomalyAlerts"),
		// 			Properties: &armsecurity.AlertsSuppressionRuleProperties{
		// 				AlertType: to.Ptr("IpAnomaly"),
		// 				Comment: to.Ptr("Test VM"),
		// 				ExpirationDateUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-12-01T19:50:47.083Z"); return t}()),
		// 				LastModifiedUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-07-31T19:50:47.083Z"); return t}()),
		// 				Reason: to.Ptr("FalsePositive"),
		// 				State: to.Ptr(armsecurity.RuleStateEnabled),
		// 				SuppressionAlertsScope: &armsecurity.SuppressionAlertsScope{
		// 					AllOf: []*armsecurity.ScopeElement{
		// 						{
		// 							AdditionalProperties: map[string]any{
		// 								"in": []any{
		// 									"104.215.95.187",
		// 									"52.164.206.56",
		// 								},
		// 							},
		// 							Field: to.Ptr("entities.ip.address"),
		// 						},
		// 						{
		// 							AdditionalProperties: map[string]any{
		// 								"contains": "POWERSHELL.EXE",
		// 							},
		// 							Field: to.Ptr("entities.process.commandline"),
		// 					}},
		// 				},
		// 			},
		// 		},
		// 		{
		// 			Name: to.Ptr("dismissDataExfiltrationAnomalyAlertsOnTestVMs"),
		// 			Type: to.Ptr("Microsoft.Security/alertsSuppressionRules"),
		// 			ID: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissDataExfiltrationAnomalyAlertsOnTestVMs"),
		// 			Properties: &armsecurity.AlertsSuppressionRuleProperties{
		// 				AlertType: to.Ptr("DataExfiltrationAnomaly"),
		// 				ExpirationDateUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-12-01T19:50:47.083Z"); return t}()),
		// 				LastModifiedUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2019-07-31T19:50:47.083Z"); return t}()),
		// 				Reason: to.Ptr("FalsePositive"),
		// 				State: to.Ptr(armsecurity.RuleStateEnabled),
		// 			},
		// 	}},
		// }
	}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

JavaScript

const { SecurityCenter } = require("@azure/arm-security");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to List of all the dismiss rules for the given subscription
 *
 * @summary List of all the dismiss rules for the given subscription
 * x-ms-original-file: specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/AlertsSuppressionRules/GetAlertsSuppressionRules_example.json
 */
async function getSuppressionRulesForSubscription() {
  const subscriptionId =
    process.env["SECURITY_SUBSCRIPTION_ID"] || "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
  const credential = new DefaultAzureCredential();
  const client = new SecurityCenter(credential, subscriptionId);
  const resArray = new Array();
  for await (let item of client.alertsSuppressionRules.list()) {
    resArray.push(item);
  }
  console.log(resArray);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.Resources;
using Azure.ResourceManager.SecurityCenter.Models;
using Azure.ResourceManager.SecurityCenter;

// Generated from example definition: specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/AlertsSuppressionRules/GetAlertsSuppressionRules_example.json
// this example is just showing the usage of "AlertsSuppressionRules_List" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this SubscriptionResource created on azure
// for more information of creating SubscriptionResource, please refer to the document of SubscriptionResource
string subscriptionId = "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
ResourceIdentifier subscriptionResourceId = SubscriptionResource.CreateResourceIdentifier(subscriptionId);
SubscriptionResource subscriptionResource = client.GetSubscriptionResource(subscriptionResourceId);

// get the collection of this SecurityAlertsSuppressionRuleResource
SecurityAlertsSuppressionRuleCollection collection = subscriptionResource.GetSecurityAlertsSuppressionRules();

// invoke the operation and iterate over the result
await foreach (SecurityAlertsSuppressionRuleResource item in collection.GetAllAsync())
{
    // the variable item is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityAlertsSuppressionRuleData resourceData = item.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

Console.WriteLine("Succeeded");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Voorbeeldrespons

Statuscode:

200

{
  "value": [
    {
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissIpAnomalyAlerts",
      "name": "dismissIpAnomalyAlerts",
      "type": "Microsoft.Security/alertsSuppressionRules",
      "properties": {
        "alertType": "IpAnomaly",
        "lastModifiedUtc": "2019-07-31T19:50:47.083633Z",
        "expirationDateUtc": "2019-12-01T19:50:47.083633Z",
        "state": "Enabled",
        "reason": "FalsePositive",
        "comment": "Test VM",
        "suppressionAlertsScope": {
          "allOf": [
            {
              "field": "entities.ip.address",
              "in": [
                "104.215.95.187",
                "52.164.206.56"
              ]
            },
            {
              "field": "entities.process.commandline",
              "contains": "POWERSHELL.EXE"
            }
          ]
        }
      }
    },
    {
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/alertsSuppressionRules/dismissDataExfiltrationAnomalyAlertsOnTestVMs",
      "name": "dismissDataExfiltrationAnomalyAlertsOnTestVMs",
      "type": "Microsoft.Security/alertsSuppressionRules",
      "properties": {
        "alertType": "DataExfiltrationAnomaly",
        "lastModifiedUtc": "2019-07-31T19:50:47.083633Z",
        "expirationDateUtc": "2019-12-01T19:50:47.083633Z",
        "state": "Enabled",
        "reason": "FalsePositive"
      }
    }
  ]
}

Definities

Name	Description
AlertsSuppressionRule	Beschrijft de onderdrukkingsregel
AlertsSuppressionRulesList	Lijst met onderdrukkingsregels voor abonnement.
CloudError	Veelvoorkomende foutreactie voor alle Azure Resource Manager-API's om foutdetails te retourneren voor mislukte bewerkingen. (Dit volgt ook de OData-foutreactieindeling.)
CloudErrorBody	De foutdetails.
ErrorAdditionalInfo	Aanvullende informatie over de resourcebeheerfout.
RuleState	Mogelijke statussen van de regel
ScopeElement	Een specifieker bereik dat wordt gebruikt om de waarschuwingen te identificeren die moeten worden onderdrukt.
SuppressionAlertsScope

AlertsSuppressionRule

Object

Beschrijft de onderdrukkingsregel

Name	Type	Description
id	string	Resource-id
name	string	Resourcenaam
properties.alertType	string	Het type waarschuwing dat automatisch wordt onderdrukt. Gebruik *voor alle waarschuwingstypen
properties.comment	string	Opmerkingen met betrekking tot de regel
properties.expirationDateUtc	string (date-time)	Vervaldatum van de regel, als de waarde niet is opgegeven of als null is opgegeven, is er helemaal geen vervaldatum
properties.lastModifiedUtc	string (date-time)	De laatste keer dat deze regel is gewijzigd
properties.reason	string	De reden voor het negeren van de waarschuwing
properties.state	RuleState	Mogelijke statussen van de regel
properties.suppressionAlertsScope	SuppressionAlertsScope	De onderdrukkingsvoorwaarden
type	string	Resourcetype

AlertsSuppressionRulesList

Object

Lijst met onderdrukkingsregels voor abonnement.

Name	Type	Description
nextLink	string	URI voor het ophalen van de volgende pagina.
value	AlertsSuppressionRule[]	Beschrijft de onderdrukkingsregel

CloudError

Object

Veelvoorkomende foutreactie voor alle Azure Resource Manager-API's om foutdetails te retourneren voor mislukte bewerkingen. (Dit volgt ook de OData-foutreactieindeling.)

Name	Type	Description
error.additionalInfo	ErrorAdditionalInfo[]	De fout bevat aanvullende informatie.
error.code	string	De foutcode.
error.details	CloudErrorBody[]	De foutdetails.
error.message	string	Het foutbericht.
error.target	string	Het foutdoel.

CloudErrorBody

Object

De foutdetails.

Name	Type	Description
additionalInfo	ErrorAdditionalInfo[]	De fout bevat aanvullende informatie.
code	string	De foutcode.
details	CloudErrorBody[]	De foutdetails.
message	string	Het foutbericht.
target	string	Het foutdoel.

ErrorAdditionalInfo

Object

Aanvullende informatie over de resourcebeheerfout.

Name	Type	Description
info	object	De aanvullende informatie.
type	string	Het extra informatietype.

RuleState

Inventarisatie

Mogelijke statussen van de regel

Waarde	Description
Disabled
Enabled
Expired

ScopeElement

Object

Een specifieker bereik dat wordt gebruikt om de waarschuwingen te identificeren die moeten worden onderdrukt.

Name	Type	Description
field	string	Het type waarschuwingsentiteit dat moet worden onderdrukt.

SuppressionAlertsScope

Object

Name	Type	Description
allOf	ScopeElement[]	Alle voorwaarden binnen moeten waar zijn om de waarschuwing te onderdrukken